ledger

Ledger CTO Charles Guillemet stated that he disagrees with the view that "only about 30% of BTC faces quantum computing risks, while the remaining approximately 70% is secure due to public key hashing."Glassnode data shows that currently about 30.2% of BTC has exposed spending public keys on-chain, but Guillemet pointed out that this only reflects the static state on-chain; unexposed public keys may still exist in xpub, devices, PSBT, logs, or backups; and once a BTC transaction is initiated, the public key will be revealed before the transaction is confirmed.Guillemet cited research from Google Quantum AI stating that under currently non-existent high-speed quantum computer models, attacks on secp256k1 could be completed in about 9 minutes. Therefore, simply hiding public keys cannot solve the quantum risk, and Bitcoin will ultimately need to migrate to post-quantum cryptography.

Hester Peirce, a commissioner of the U.S. Securities and Exchange Commission (SEC), stated at the SIFMA Digital Assets Conference that regulators should reconsider traditional financial monitoring methods, shifting from "collecting more data" to utilizing new technologies for more precise verification.Peirce mentioned that technologies like zero-knowledge proofs can verify whether users meet requirements such as age, citizenship, accredited investor status, or sanctions lists without disclosing underlying personal information like names, income, or addresses.Hester Peirce suggested that the federal government and regulatory agencies adopt attribute-based verification when technically feasible and allow registered entities to rely more on third-party identity verification to reduce the redundant collection and storage of sensitive information.Peirce also stated that public blockchains have permanent, public, and auditable transaction records, and combined with blockchain forensic tools, they are expected to enhance the ability to track illegal activities while reducing unnecessary data collection.

IBM announced that customers of its digital asset management platform IBM Digital Asset Haven can now connect to permissioned blockchain networks, including the blockchain-based shared ledger from Swift. A new beta version of the ISO 20022 message adapter allows financial institutions to initiate tokenized deposit transactions through this ledger using standard payment messages. IBM stated that financial institutions participating in Swift-related programs have tested tokenized deposits on this ledger using Digital Asset Haven. The ledger supports tokenized deposits issued by banks, enabling participating IBM clients to transfer digital assets around the clock, with final settlement still completed through existing systems.Swift first announced this ledger at Sibos 2025, based on a prototype developed in collaboration with Consensys, with over 40 financial institutions involved in its design, 17 of which are participating in the tokenized deposit pilot. Swift currently connects over 12,500 financial institutions across more than 200 markets worldwide. The aforementioned message adapter allows banks to continue using existing payment message formats and operational processes without adopting blockchain-specific workflows.IBM is also expanding Digital Asset Haven to a localized deployment beta version, which can be installed on IBM Z and IBM LinuxONE in the client's own data center for managing digital assets such as stablecoins and tokenized deposits, without relying on public cloud infrastructure. IBM stated that the platform and key management layer are fully retained within the client's own environment, with keys protected by IBM Crypto Express hardware security modules.

The PermissionDelegationV1_1 upgrade of the XRP Ledger entered a 14-day activation countdown on September 21, having received support from 29 of the 35 trusted validator nodes. If the support rate remains above 80% during this period, the upgrade could officially activate as early as October 5 at 11:18 UTC; at least 28 validator nodes must continue to support it, or the countdown will reset.This feature allows accounts to split permissions by role. For example, a stablecoin issuer can allow a connected compliance system to approve customer accounts holding its tokens while keeping the keys with full control offline; operational accounts can gain payment permissions but cannot change keys or delegate authority to others. Each trustee can have up to 10 permissions, and the main account can modify or revoke them at any time.This is the network's second attempt to introduce this feature. The original version had vulnerabilities that attackers could exploit to make others pay transaction fees with improperly signed transactions, and by repeatedly submitting high-fee transactions, they could deplete the victim's XRP balance. This vulnerability was reported by community testers on September 15, 2025, and validator nodes were advised to reject the amendment, so it was never activated. The fixed version was released with xrpld 3.3.0, changing the way unauthorized transactions are rejected, ensuring that fees are not deducted before signature verification.

According to official news, Reap, a payment company under Kraken's parent company Payward, has launched a Virtual Asset Ledger. Users of exchanges, wallets, new banks, and financial technology platforms can directly use their virtual asset balances such as BTC to make purchases with the Visa card issued by Reap, with conversions completed at real-time exchange rates during payment, without the need to pre-convert to stablecoins.Reap data shows that by July 2026, the card consumption amount paid with virtual assets will reach 1.04 billion USD.

Vitalik Buterin, co-founder of Ethereum, delivered a keynote speech at the 12th Global Blockchain Summit, stating that the blockchain was initially a primary tool. Although it has characteristics such as openness, neutrality, and security, it is not scalable and is completely transparent, lacking privacy protection mechanisms.Subsequently, privacy transactions and scalable verification brought by zero-knowledge proofs have changed this situation and have been transformed from planning into actual EIPs, included in the Ethereum roadmap. Technologies such as fully homomorphic encryption are also beginning to be applied, and indistinguishable obfuscation may also be applied on-chain in the future. Beyond privacy, the parallel construction and proof of blocks can make extreme scalability possible, and industry thinking has shifted from digital assets to digital assets plus information, from purely on-chain to user-end, transaction memory pools, a complete pipeline on-chain, and from who can send what to who can see what.Currently, blockchain has gradually evolved from a simple ledger to a cryptography-based secure computing network. With the development of AI, providing cryptographic rules to AI for automated formal verification can significantly enhance verification efficiency, allowing the chain to carry more possibilities.

According to CoinDesk, Ripple stated that asset management companies and other commercial projects are preparing to use the Batch V1.1 feature of the XRP Ledger. This feature allows up to eight transactions to be combined into a single operation and ensures that all transactions either succeed or fail in an all-or-nothing manner, avoiding situations where one party completes settlement while the other fails.This upgrade is expected to support Delivery Versus Payment (DVP) transactions, allowing asset transfers and payments to be completed simultaneously, while also enabling exchanges, wallets, and market platforms to directly attach service fees to customer transactions for processing.RippleX Engineering Director Ayo Akinyele mentioned that some projects are already being developed around Batch, and once activated, it will bring related work closer to a production environment. Specific partners and launch times will be announced once plans are finalized. The amendment has received support from 30 of the 35 tracked validators on the XRP Ledger, exceeding the 28 votes required to enter the activation countdown. The countdown began on September 15, and if the validator support rate remains above 80% within 14 days, Batch V1.1 is expected to be activated shortly after September 29.Previously, researchers discovered serious flaws in the Batch V1 signature verification process in February, which could prematurely stop checking signatures under certain conditions, allowing attackers to unauthorizedly include transactions from other accounts. The developers subsequently withdrew the original version. Since the amendment had not yet been activated at that time, the vulnerability code did not run on the live ledger, and no funds were exposed.

The Batch V1.1 upgrade for the XRP Ledger is just one vote away from initiating the activation process. The RippleX team has fixed 11 software defects in the latest review. The Batch feature allows users to combine up to eight related transactions into a single operation, ensuring that both parties complete the transfer simultaneously when two people exchange tokens, thus avoiding the situation where one party pays while the other fails.In Tuesday's snapshot, the upgrade received support from 27 out of 35 trusted validators, accounting for approximately 77%, while changes to the XRP Ledger require an 80% support rate. Therefore, currently, one validator's vote can determine success or failure, and obtaining one more vote will initiate a two-week activation countdown. The support rate must remain above this threshold for 14 days, during which validators can change their votes.Previously, researchers discovered vulnerabilities in the original Batch proposal, allowing attackers to initiate transactions using others' accounts without authorization under specific conditions; this version was not deployed on the mainnet. The new version was released with xrpld 3.3.0 on August 6, and the latest review found 11 issues related to signatures, authorization checks, and server crashes. Among these, a serious vulnerability rated by the security company Common Prefix could allow attackers to reuse user signature permissions to execute transactions beyond expectations. RippleX stated that the review involved four senior engineers, audits from Halborn and Common Prefix, public security competitions, and automated testing, and mentioned that commercial projects using Batch have been signed or are in development.

According to Bitcoin.com News, the supply of Ripple's stablecoin RLUSD reached a historical high of $2.442 billion this week, an increase of about 41% compared to $1.72 billion a month ago.It is worth noting that the new supply mainly flowed into Ethereum rather than XRP Ledger—Ethereum currently holds $1.37 billion, while XRP Ledger holds $1.05 billion, completely reversing the pattern from July when XRP Ledger accounted for 58.9%. Since July, Ethereum has absorbed the vast majority of the approximately $840 million in new supply.

The U.S. Securities and Exchange Commission (SEC) proposed a new rule last week to comprehensively revise the transfer agent rules that have been in place for decades, explicitly allowing electronic databases, including blockchain ledgers, to serve as the official record of securities ownership for the first time. If approved, blockchain is expected to become the "master security document," replacing the off-chain parallel ownership records that tokenized securities currently rely on.Currently, many tokenized securities operate on two sets of records: on-chain token ledgers and official shareholder registers. Once the proposal is passed, issuers and transfer agents may no longer need to maintain duplicate records and reconcile them after each transfer, thereby reducing operational friction and the risk of inconsistencies between on-chain records and legally recognized records. Eli Cohen, Chief Legal Officer of the tokenized fund platform Centrifuge, stated that this proposal could transform the current "two-step" process into a "one-step" process, allowing the blockchain itself to act as the master security document.However, the proposal does not mean that tokenized securities are completely "permissionless." Joris Delanoue, CEO of the registered on-chain transfer agent Fairmint, pointed out that while the blockchain can remain open, assets must still comply with ownership and transfer rules, and regulatory controls such as identity verification and transfer restrictions are still embedded in the tokens. Transfer agents will still need to handle administrative matters such as shareholder death, inheritance, and legal notifications, with processing times potentially reduced from 3-5 days to 1 day. The 60-day public comment period for the proposal will end in early November.

According to Bloomberg, cryptocurrency hardware wallet manufacturer Ledger SAS announced the appointment of Oded Blatman as Chief Information Officer (CIO) and Chief Security Officer (CSO), integrating internal technology systems and security functions under the same executive management.Blatman previously worked at the blockchain company Fireblocks and will be fully responsible for network and infrastructure security, product security, physical and workplace security, internal IT, and enterprise risk management.

DBS and Citibank's New York office completed a cross-border payment in US dollars between Singapore and the United States on September 5 using tokenized deposits through the Swift Digital Ledger. The transaction was executed over the weekend and took only a few minutes, while traditional cross-border payments typically take up to two business days, allowing businesses to avoid losing time due to time zone differences and weekend gaps. This is the second confirmed real-time application of the ledger, following HSBC and Standard Chartered's completion of the first real-time tokenized deposit cross-border transaction in August. Swift announced the ledger's preliminary availability on July 9, with 17 banks ready to pilot it, and DBS is the only bank headquartered in Asia among the 12 core design group members. DBS Group Chief Operating Officer Rachel Chew stated that the Swift Digital Ledger is connecting traditional banking infrastructure with emerging digital networks to drive the practical application of tokenized currency from experimentation. Citibank's Head of South Asia Services Mridula Iyer noted that weekend real-time transactions prove that around-the-clock cross-border payments have become a reality. DBS will launch DBS Token Services in 2024, offering 24/7 programmable instant value transfer services.

Hardware wallet manufacturers Ledger and Trezor are calling on security researchers to adopt a more responsible approach to vulnerability disclosure. Ledger's Chief Technology Officer Charles Guillemet stated on the X platform that artificial intelligence has made vulnerabilities easier to discover and exploit, but some researchers disclose details before a fix is released, which he termed "exploiting others' risks for attention."Guillemet urged researchers to report vulnerabilities privately first and to agree on a timeline for fixes before disclosing details publicly, suggesting 90 days as a common default period, while also indicating that this could be adjusted flexibly based on the severity of the vulnerability and the amount of work required for the fix. Trezor's Security Chief Jan Komárek told Cointelegraph that 90 days is a commitment to vendors, not just an obligation for researchers. He suggested that researchers first contact vendors to agree on a timeline, and if the vendor fails to complete the fix within that period, they may choose to disclose publicly.The context of this statement is the recent close attention to hardware wallet security: the Coldcard theft incident involved over $100 million, and a data breach at Trezor's logistics provider also affected the personal information of tens of thousands of customers.

Evernorth's report shows that the number of XRP Ledger accounts has decreased, but the volume of single transactions has nearly tripled, with the total network value driven by stablecoins surpassing 4.2 billion dollars.

According to lawyer Ariel Givner, cryptocurrency hardware wallet manufacturer Ledger is facing a class-action lawsuit in the United States due to a security incident in 2023. The plaintiffs claim that the incident led to the leakage of personal identification information such as customer names, email addresses, and phone numbers, and that Ledger failed to timely and adequately disclose the relevant situation.The lawsuit also points out that hackers subsequently used this contact information to impersonate Ledger, tricking users into approving fraudulent transactions and stealing cryptocurrency assets.

Ayo Akinyele, Senior Director of Engineering at Ripple, stated that the company is developing a four-phase quantum-resistant migration plan for the XRP Ledger, aiming to complete the transition before quantum computers become a real threat. The plan includes assessing the network's exposure, testing quantum-resistant cryptographic solutions, running existing security systems in parallel with quantum-resistant alternatives, and preparing emergency response pathways for scenarios where quantum computing advances exceed expectations.Akinyele emphasized that migration is not just about replacing a cryptographic algorithm, but requires more flexible infrastructure, stronger key management, and clearer upgrade paths. The XRP Ledger has supported changing the keys that control accounts without altering the accounts themselves, a feature that is expected to reduce the difficulty of future migrations, but independent validators on the network still need to coordinate any broader rule changes.Meanwhile, Anthropic's model last month reduced the workload required to break leading post-quantum signature candidates by 67 million times, and Bitcoin and Ethereum developers also released their respective migration plans this week. Akinyele pointed out that AI and quantum computing are different technologies, but they are driving financial infrastructure to evolve in the same direction, as AI agents begin to trade and pay autonomously, raising new requirements for payment infrastructure that is always online and natively internet-based.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

Yesterday, Ledger disclosed details of the LSB 023 security vulnerability on its official website. Some applications built on the Ledger Secure SDK may still receive new APDU commands during the user screen confirmation, leading to inconsistencies between the parameters displayed on the screen and the final signature parameters.In cases where the attacker controls the APDU communication between the device and the host, after the user confirms the operation shown on the screen, the device may generate a signature with different parameters. Ledger stated that it has fixed the issue through application-level checks and the SDK layer, and released Ledger Secure SDK v26.6.1 on August 21. The relevant applications have been rebuilt and released. Users need to update the applications through Ledger Live; merely updating the device firmware is insufficient to complete the fix. However, Ledger claims there is currently no evidence that the vulnerability has been exploited.

Ledger's Chief Technology Officer Charles Guillemet stated that there has recently been "FUD" targeting Ledger in the market, as a smart contract security company claimed to have discovered vulnerabilities in the Ledger Ethereum application. Guillemet mentioned that there indeed were vulnerabilities related to certain Clear Signing processes in the Ledger Ethereum application, but these vulnerabilities were discovered by Ledger's security research team Donjon using AI-driven vulnerability research tools, and the fixes were completed and deployed two weeks ago. Users can obtain protection by timely updating their Ledger device firmware and applications.The relevant security company contacted Ledger's bug bounty program only after the fixes were completed, did not follow responsible disclosure processes, and did not communicate with the bug bounty team, yet implied in subsequent content that the issue had not been resolved. This approach is not true security research but rather a way to create panic for attention. AI is changing the cybersecurity landscape, and both attackers and defenders can enhance efficiency with AI, but AI-driven security research can only truly enhance the security of the entire ecosystem when basic security principles such as responsible disclosure and pre-release verification are followed.Guillemet finally reminded Ledger users to keep their device firmware, Ledger applications, and related software up to date to automatically receive the latest security fixes and research results. Users should not be influenced by the related "FUD" and should timely update their software and maintain safe habits.

According to CoinDesk, Ripple's stablecoin RLUSD has surpassed a market capitalization of $2 billion, becoming one of the fastest-growing projects in the stablecoin market. Data shows that the total issuance of RLUSD is currently around $2 billion, with approximately $963 million deployed on the XRP Ledger and about $1.1 billion issued on the Ethereum network.Ripple previously stated that RLUSD will combine with its global payment network to provide more efficient on-chain liquidity solutions for businesses and financial institutions.